The invention relates to a process and a system for rapidly and safely activating fuel pumps. In particular, the invention relates to a process and a system for rapidly and safely activating electronic fuel pumps for a motor vehicle in the event of a vehicle crash.
Fuel pumps are used in injection systems of internal-combustion engines and have the purpose of delivering fuel intended for combustion from a tank for supply to the internal-combustion engine by way of a pressurized supply system.
Electronic fuel pumps, in particular, are used in current motor vehicles. They are controlled electronically and, according to certain requirements, provide the currently necessary amount of fuel for the combustion. To that end, the fuel pumps receive signals or information, for example, by way of the CAN bus of the vehicle, concerning the current fuel demand, so that the corresponding controlling of the fuel pump can take place for the delivery of the current amount of fuel. Usually, the signal or the information are provided by the vehicle drive or its control device and are forwarded to the fuel pump.
In the event of an accident of the vehicle, particularly in the event of a crash, there is a danger that fuel may escape from the pressurized supply system as a result of damage or leaks and may be ignited by the effect of heat. In order to reduce a resulting acute fire hazard, it is known to switch off the electronic fuel pump in the event of a crash by way of a crash signal of a crash recognition system in order to stop the fuel delivery. Such a switching-off takes place, for example, by way of an engine control device, which can activate a fuel pump relay in response to a corresponding crash signal.
Various systems for switching off a fuel pump are known from the prior art. Thus, German reference DE 198 41 659 A1 describes a process for controlling a fuel pump for a motor vehicle, wherein the fuel pump can be switched off as a result of a crash signal by the engine control device because of an accident.
From reference DE 38 40 912, a fuel supply system for a motor vehicle is known which, among other things, describes a safety device for the independent deactivating of a fuel pump in the event of a crash, the safety device utilizing crash-caused forces for this purpose.
However, the known systems for switching off the fuel pump have in common that a switch-off signal is not generated until after a recognition of an actual physical crash event and, for switching off the fuel pump, is transmitted to the latter.
The recognition of an actual crash situation takes place corresponding to generally known processes and systems. However, since this recognition is no simple binary decision but rather first requires evaluations of building-up stresses and decelerations, valuable time goes by until a decision can be made whether or not an actual crash situation is present. When a positive result is determined, a triggering of certain safety systems, such as airbags, takes place.
The known systems therefore have the disadvantage that a time period from the start of the crash, thus the actual first contact of the vehicle with an obstacle, to the sending of the switch-off signals, based on the principle, lasts relatively long. An empirical value for this time period used as an example is approximately 80 ms. In addition, further time delays until the reception of the switch-off signals in the electronic fuel pump take place, among other reasons, because of system-related latency periods. In this respect, an empirical value also only used as an example is an additional time period of approximately 100 ms, so that the total duration is approximately 180 ms in order to recognize a crash and to forward a switch-off signal based on this crash or a signal generated by it to the electronic fuel pump.
Since a crash of a vehicle will result in considerable destruction within a very short time period, for example, 200 ms, it cannot be excluded in the case of a crash that the fuel lines are damaged and become leaky, so that fuel may already escape before the fuel pump is switched off. In addition, it cannot be excluded that, as a result of the crash, particularly because of the resulting destruction and penetrating objects or components (intrusions), a communication-related connection to the fuel pump will be interrupted so that the switch-off signal sent to the fuel pump can no longer reach the latter and a switch-off therefore does not take place.
This applies particularly to a lateral crash because, in this case, considerable destructions and intrusions may take place within clearly shorter time periods, which may lead to the described damage of the fuel line as well to an interruption of an activation of the fuel pump. If this occurs, it is neither possible to transmit a switch-off signal nor any other signal to the fuel pump, such as a signal for reducing the current fuel delivery volume or for a complete switch-off. This means that, in the case of an actual crash, a fuel pump—if still operational—will continue to deliver fuel, so that this fuel is released, and the risk of fire is increased or a fire is facilitated. In the worst case, this means that the fuel tank of the vehicle is pumped dry.
Although electronic fuel pumps have a fallback level, which indicates a defined delivery volume value for a case in which a control signal for providing information on the fuel volume to be delivered at the current time fails to materialize, this value is normally defined for a delivery volume value that corresponds to an opening position of the fuel pump. The reason is that a switching-off of the fuel pump, in the case of a (briefly) absent signal, for example, because of a defect in the signal-generating or signal-transmitting components, is to be prevented. Although in this manner a failure probability can be lowered in the case of this disturbance, simultaneously, fuel continues to be delivered in a crash situation—as described above. In contrast, although an opposite definition of the delivery volume value defined as the fallback level corresponding to a closing position would prevent the delivery operation in a crash situation, in the case of absent signals, it would lead to an involuntary stop of the vehicle because of the unintended switching-off of the fuel pump.
A conflict therefore exists in the state of the art when defining the fallback level between failure safety with a fuel delivery volume that is as high as possible under the aspect of a reliability of the vehicle, on the one hand, and safety in the case of a crash with a delivery volume that is as low as possible, on the other hand. Contradictory demands therefore exist so that, depending on the configuration, there is either a safety risk or an availability risk.
It is therefore an object of the invention to overcome or reduce the above-mentioned disadvantages and particularly provide an activation of a fuel pump which fulfils both aspects—thus, a high availability, on the one hand, as well as the best-possible safety in the event of an accident, on the other hand.
According to the invention, this object is achieved by providing a process for the rapid and safe activating of a fuel pump, as well as a control system for such an electronic fuel pump, having a definable fallback level for a delivery volume of the fuel pump. The process includes the acts of: recognizing a possible crash situation; and defining the fallback level as a first delivery volume value which is assigned to a closing position of the fuel pump in response to the recognized possible crash situation.
The described process therefore makes it possible to define a fallback level of a fuel pump, particularly of an electronic fuel pump, not globally ahead of time as an unchangeable value but to carry out a suitable definition as a function of the requirements. A demand exists here in the case of a possible crash of the vehicle.
The term “possible” crash situation should be understood such that either a situation exists in which a crash has not yet actually taken place but is only threatening, or, although the crash has already taken place or started, it has not yet been recognized as an actual crash by a known crash recognition. In other words, it is recognized in this step that there is the possibility that a crash is already occurring or could be directly imminent. Corresponding signs for the recognition of the possible crash will be described in detail in the following. The recognition of the described “possible” crash is therefore followed by the step of recognizing the actual crash (if there is one).
In contrast to the known recognition of an actual crash, the described recognition of a possible crash situation is provided such that, because of increased loads and decelerations, the crash recognition device already concludes before the recognition of an actual crash that an actual crash will be imminent. For reasons of a vehicle availability and reliability that should be as optimal as possible, however, in this case, no switching-off of the fuel pump should take place yet as long as no actual crash situation has been determined.
When such a possible crash is therefore recognized by a crash recognition device according to the invention, the above-mentioned definition of the fallback level of the fuel pump takes place in preparation for the subsequent actual crash. Within the scope of this definition step, the fuel pump receives a corresponding signal or information from the crash recognition device so that a storing of the corresponding first delivery volume value can be carried out. This delivery volume value is either stored directly by the crash recognition device in the fuel pump by way of the signal or the fuel pump itself carries out the definition of the delivery volume value in response to the information of the crash recognition device.
The first delivery volume value is assigned to a closing position of the fuel pump, so that, when the value is applied, the fuel pump is moved into its closing position and is thereby closed. This first delivery volume value can therefore describe, for example, a delivery volume value of 0 liter/min or an opening degree or delivery degree of the fuel pump of 0%. When the first delivery volume value is applied, the flow rate of the fuel pump is therefore reduced completely, so that, in this case, no more fuel is pumped by the fuel pump. The fuel pump is therefore preferably switched off.
Naturally, the first delivery volume value may also be defined to have a value greater than 0 liter/min if that should be desirable, so that, for example, a reduced flow rate will be stored by a corresponding value.
The step of defining the fallback level therefore results only in a storing of the first delivery volume value, but has no direct influence on the actual delivery volume of the fuel pump in a normal operation of the vehicle. As long as the fuel pump receives signals or information concerning a current demand of the fuel volume to be delivered, the fallback level will not be taken into account. The described step of defining the fallback level, in particular, does not yet cause an immediate reduction of the current delivery volume. The fuel pump is therefore only changed to a ready state for a later switch-off. The electronic fuel pump will recognize a defective operating state only in the absence of information or in the absence of a communication and will fall back to the fallback level or the first delivery volume value stored there, which will then lead to stoppage of the corresponding delivery volume.
The process therefore comprises the following steps:
(a) recognition of an actual crash situation, and
(b) use of the delivery volume value defined as the fallback level for closing the fuel pump in response to the actually recognized crash situation.
The fuel pump therefore recognizes a defective operating state and is thereby caused to fall back to a delivery volume value defined at the fallback level. Therefore, if, as a result of a recognized possible crash situation, the first delivery volume value was stored for closing the fuel pump, because of the application of this value, the delivery operation of the fuel pump will be stopped.
If, in contrast, no possible crash situation is recognized beforehand, the first delivery volume value will not be stored at the fallback level but preferably a further delivery volume value which corresponds to an opening position of the fuel pump, in order to prevent an unintended switching-off of the fuel pump. This may be the case, for example, in the event of a sudden failure of a communication of the fuel pump because of a technical defect. The further delivery volume value will then be used for ensuring a further operation of the fuel pump. For this purpose, the further delivery volume value will preferably be defined to be greater than 0 liter/min.
Since the step of the definition of the fallback level according to the invention precedes the step of recognizing an actual crash situation, as a result of this “preconditioning” of the fallback level, the time period between an actual crash start (thus, the first contact) and the known sending of information for the crash switch-off does not go by unutilized. Particularly by using the described process, a possibility is provided for a reliable switching-off in the event that a communication connection for activating the fuel pump breaks off as a result of effects of the crash.
According to a further embodiment of the invention, the process further comprises the following steps:
recognizing an absence of a crash situation after the expiration of a defined time interval, and
defining the fallback level to be a second delivery volume value which is assigned to an opening position of the fuel pump.
Thus, when a possible crash situation was recognized and the fallback level was correspondingly defined in preparation for an actual crash situation, it may happen that no actual crash will follow. The “expected” crash will be “absent”. This may be so, for example, in the case of a “false alarm”, thus an incorrectly recognized possible crash situation or a crash situation that was averted after the recognition. In this case, a resetting of the stored delivery volume value of the fallback level has to take place in order to prevent an unintended switching-off of the fuel pump. The fallback level is therefore redefined and the second delivery volume value is stored. The latter replaces the first delivery volume value and is assigned to an opening position so that, when it is used, the fuel pump will provide a corresponding delivery volume of fuel. For this purpose, the second delivery volume value is preferably assigned to a delivery volume greater than 0 liter/min.
If now there is a case in which the fuel pump loses its communication connection and receives no further information or signals, it will use the fallback level and the second delivery volume value so that a sufficient amount of fuel will be made available for the further operation of the internal-combustion engine and a failure of the vehicle will thereby be prevented.
Such a resetting of the first delivery volume value to the second delivery volume value can automatically take place after the expiration of a defined time interval. In other words, when a possible crash situation is recognized and the fallback level is defined to the first delivery volume value, thus the fuel pump is changed to a ready state, a time recording will be started. If no confirmation of a crash takes place within a defined time interval by the recognition of an actual crash, the recognition of the possible crash situation may be classified as a false alarm and the fallback level may be defined to the second delivery volume value. This second delivery volume value represents, for example, a normal operating state of the vehicle. Depending on the requirements, the defined time interval may be selected such that that it can be ensured that a crash situation has been overcome; it preferably amounts to 3 to 20 seconds, preferably not more than 5 to 10 seconds.
According to another embodiment, the process, in addition, comprises the following steps:
recognizing an absence of a crash situation by use of evaluating sensor data, and
defining the fallback level to a second delivery volume value which is assigned to an opening position of the fuel pump.
Corresponding to the above representation, an absent crash situation, i.e. the absence of an expected crash or a false alarm, is therefore recognized. In contrast to the preceding embodiment, the latter is not determined on the basis of an eventless expiration of a time interval but by the acquisition and evaluation of sensor data, which suggest a normal operating state of the vehicle. As described above, subsequently, a defining of the fallback level also takes place to a second delivery volume level, which is assigned to a normal operating state of the vehicle and defines a certain delivery volume of the fuel pump.
Naturally, the two embodiments can be combined with one another so that, the expiration of a time interval as well as the evaluation of sensor data can be used for the step of defining the fallback level to the second delivery volume value.
A corresponding evaluation of sensor data, which can be used as indicators for a normal operating state of the vehicle, includes, for example, a user-controlled acceleration of the vehicle, a gear change or actuations of vehicle functions which typically could not or would not take place in the event of an actual crash.
The above-mentioned step of recognizing a possible crash situation may preferably include at least one of the following steps:
acquiring sensor data,
evaluating the acquired sensor data,
comparing the acquired or evaluated sensor data with predefined threshold values,
computing a probability of a possible crash situation by use of the acquired or evaluated sensor data, and/or
making a decision about the presence of a possible crash situation.
The step of acquiring sensor data for the recognition of a possible crash situation can preferably include a taking into account of sensors for monitoring the surroundings of the vehicle. Various systems are known for this purpose, such as cameras, proximity radar or distance sensors. These permit a recognition of potential collision objects already before an actual contact with the vehicle. If, for example, the determined distance falls below a predefined threshold value, a possible crash situation is recognized without an actual crash already having occurred. A corresponding definition of the fallback level can therefore already be carried out in a preventive manner.
Furthermore, braking or stability sensors can be used, which register unusual measured values, for example, high deceleration values in the case of a hard braking of the vehicle, or acceleration values, preferably a lateral and vertical acceleration of the vehicle. For example, an activation of the ABS or ESP or of other driver assistance systems can also be taken into account.
Likewise, possible crash situations can be determined from information provided by other vehicles concerning the environment or an infrastructure, thus, so-called “Car2Car” or “Car2Infrastructure” systems. These permit, for example, a particularly anticipatory recognition of a possible crash situation.
Generally, every sensor can therefore be used whose measured data can point to a possible accident danger, so that the described process can be carried out even before a first contact of the vehicle within the scope of a collision or a crash. This naturally applies not only to an acquisition before but also during the crash, preferably immediately after a first contact of the vehicle, until the recognition of the actual crash by the known systems.
Naturally, the acquired sensor data can be additionally processed within the scope of an optional evaluation step and can be analyzed corresponding to the requirements, in order to achieve the best-possible results for a recognition that is as precise as possible.
Within that scope, the sensor data, either the acquired and/or the already evaluated sensor data, can be compared with predefined threshold values, in order to recognize in this manner a deviation from a normal operating state of the vehicle or dangerous situations (for example, a rollover or a full braking).
Furthermore, a probability of a possible crash situation can be computed. For this purpose, any suitable linking of the different sensor data of a vehicle is contemplated. One example is the determination of a distance from a recognized obstacle as well as the simultaneous determination of a speed relative thereto. If this speed is comparatively high in view of the insufficient distance, or a threatening collision can possibly no longer be averted, a high probability of a threatening collision is assumed. By way of the probability consideration, signals of the sensors can therefore be used, and can be used and evaluated with respect to a potential collision danger, i.e. for recognizing a possible crash situation.
Within the scope of the decision step, the data and/or the computed probabilities can be used for a final decision of whether or not a possible crash situation was recognized.
Furthermore, a control system is provided for an electronic fuel pump, having a crash recognition device, and an electronic fuel pump with a definable fallback level. The crash recognition device is connected with the electronic fuel pump relative to communication, and the crash recognition device is designed for implementing the described process according to the invention.
Here, the crash recognition device preferably takes over the steps of recognizing the possible crash situation and provides corresponding signals. For this purpose, the crash recognition device has correspondingly designed devices. As described above, a definition of the fallback level of the fuel pump can be implemented by the fuel pump itself or also by the crash recognition device.
According to an embodiment of the control system, the crash recognition device and the electronic fuel pump are directly and/or indirectly connected with one another with respect to communication. The indirect communication of the crash recognition device with the fuel pump can, for example, take place by way of a vehicle drive, so that the crash recognition device can utilize an existing communication connection between the vehicle drive and the electronic fuel pump, for example, the CAN bus, for the transmission of its signals and information. The control system is preferably coordinated such that a transmission speed is sufficiently high in order to make the signals of the crash recognition device available before a possible interruption of the communication connection to the fuel pump.
As an alternative or in addition, a direct communication-related connection can be provided between the crash recognition device and the fuel pump (a so-called point-to-point connection). This permits a shorter and, on the whole, faster transmission of signals and information so that, in comparison to the described indirect further development, bus- or architecture-specific latency periods can clearly be reduced. An even faster and more reliable definition of the fallback level of the fuel pump can therefore take place, still before the fuel lines or communication connections are damaged.
According to a further embodiment, the communication-related connection between the crash recognition device and the electronic fuel pump can be constructed in a unidirectional and/or bidirectional fashion.
In the case of a unidirectional connection, an exchange of signals and information takes place in only one direction, preferably from the crash recognition device to the fuel pump. However, as an alternative or in addition, a bidirectional connection can also be provided. This permits a communication in both directions; thus, from the crash recognition device to the fuel pump and in the opposite direction. This has the additional advantage that a quality and an availability of the communication-related connection can be ensured and monitored. Both embodiments of the communication-related connection can be used for an indirect as well as for the direct connection.
As also described above, sensors are used for the recognition of a possible crash situation. For this purpose, the crash recognition device is connected with respect to communication with sensors for recognizing the crash situation. For this purpose, the crash recognition device may have its own sensors or use corresponding sensors of the vehicle in order to implement the described process.
Other objects, advantages and novel features of the present invention will become apparent from the following detailed description of one or more preferred embodiments when considered in conjunction with the accompanying drawings